Virginia's July 1 Law Turned Every Internal Req Into a Comp Leak. You Have 15 Days.

Governor Abigail Spanberger signed SB 215 on April 22, 2026, and it took effect July 1. If you recruit into Virginia, or into any remote role a Virginian could plausibly fill, two things are now true that weren't true on June 30. Every internal req your target company posts is a compensation broadcast. And every "what are you currently making?" your team asks is a private cause of action with no cure window.

That is a strange combination of rules. It tilts leverage toward whoever moves first, and this piece is about why the first movers are sourcers, not compliance teams.

What SB 215 / HB 636 actually does

Strip the client alerts down and the Virginia Pay Transparency Act does five things at once.

1. Applies to every employer with one or more Virginia employees. No 15-person floor like Maryland, no 10-person floor like Maine's parallel law. One Virginia W-2 puts you in scope.
2. Requires a good-faith pay range in every posting, public or internal, for any job, promotion, transfer, or "other employment opportunity."
3. Bans salary history inquiries. You cannot ask what a candidate makes now or made previously. If they volunteer it, you may only use it to justify a higher offer, never a lower one.
4. Creates a private right of action. Virginia is now one of only two states (Washington is the other) where a candidate can sue directly over a job posting.
5. Gives a 15-business-day cure window for posting violations only. Salary history questions, retaliation, and refusal-to-interview claims have no cure.

Virginia is the first Southern state to pass this. Delegate Michelle Lopes Maldonado carried HB 636. Governor Spanberger's predecessor Glenn Youngkin vetoed it twice. Now it is law, and the enforcement design is the interesting part.

The cure window is a bounty

Read the cure language carefully. Anyone can send written notice. Not just an applicant. Not just an employee. Anyone. Once notice is sent, the employer has 15 business days to correct the posting on every original location to defeat a private suit.

That is a bounty. It is the same structural pattern that produced the wave of monitoring services after New York City's Local Law 32 and Washington's SB 5761. Expect the same thing here: activist plaintiffs, competing employers, laid-off ex-staff, and monitoring bots watching Greenhouse and Ashby feeds for missing ranges. The Attorney General's penalties (up to $1,000 first violation, up to $5,000 subsequent) are almost beside the point. The private-action machine is the enforcement engine.

15

Why your target company's internal board is now your comp file

Here is the shift that most compliance memos miss. The statute requires good-faith ranges in internal postings, not just external ones. Every internal transfer, every promotion req, every "we're opening a Staff Backend role on the Payments team" note in Workday now carries a legally attested range.

Which means one screenshot from a friendly ex-employee tells you, on the record, what the target company pays for the exact seat you're trying to poach into your own.

Before July 1, competitive comp intel was assembled from Levels.fyi self-reports, Blind noise, and whatever your candidates volunteered under NDA. After July 1, the target company's own TA team is publishing benchmarks under legal duress. That is a structural gift to whoever is set up to act on it.

The three signals hiding in a leaked internal req

• The floor. Good-faith range breadth is going to be litigated, following the New Jersey pattern. Employers will narrow ranges to reduce exposure. That narrowing means the low end of the posted band is close to the real floor for that level.
• The level topology. Two internal postings, side by side, expose the delta between L5 and L6. Or between "Senior" and "Staff." Or between IC and manager tracks. You are reading the org's actual compensation architecture, not a Levels.fyi guess.
• The promotion trap. Williams Mullen's analysis flagged this: if a $100K role is posted and a $60K internal candidate is promoted into it, the employer must pay $100K. The pre-promotion salary cannot drag the offer down. Which means when you find an internal candidate whose LinkedIn shows a recent title bump, the company just legally admitted they are being paid at least the floor of that range. Your outreach can say so.

This is the pitch angle that flips: "Your employer just published, in writing, that this role pays at least $X. Are you being paid at the top of the band or the bottom?" No sourcer had that line on June 30. Every sourcer has it now.

The friction is that internal postings live behind SSO, and screenshots surface unpredictably across Blind, Reddit, and Twitter. This is exactly the kind of "find people whose current employer just re-leveled their band" query that is hard to express in Boolean but easy in plain English, which is one of the reasons we built Refolk: describe the target in a sentence and get a ranked list across GitHub, LinkedIn, and the open web.

Rewrite your first-touch script this week

The single biggest exposure your team has is not a bad posting. A bad posting has a 15-day cure. Your exposure is the script your sourcers and coordinators run on the first phone screen.

The following questions are now landmines in Virginia, and because there is no cure window, one recorded call is enough:

• "What's your current base?"
• "What did you make at your last role?"
• "What are your expectations based on your current comp?"
• "We benchmark against your current package. What is it?"

Replace all four with forward-looking equivalents:

• "What comp range would you need to see to leave your current role?"
• "What's your target base and total comp for your next move?"
• "Our range for this role is $X to $Y. Where in that range would land for you?"

Note the last one. Under Virginia's rules you are already required to have a good-faith range on the posting. Leading with the range removes the reason recruiters used to ask about history in the first place. It also demonstrates compliance in the transcript, which matters if a plaintiff's lawyer ever subpoenas the recording.

The posting has a 15 day cure. The phone screen does not.

The ATS and staffing partner cleanup

Third-party recruiters and staffing agencies are in scope. Morgan Lewis and PilieroMazza both flagged the same operational tasks:

• Turn off any ATS field, application form, or screening question that requests current or prior salary. Greenhouse, Lever, Ashby, and Workday all ship these fields on by default in some templates.
• Send written notice to every staffing partner that they must not collect salary history on your behalf.
• Update your intake forms with hiring managers so the "target salary" field asks for a budgeted range, not a candidate's current pay.
• For voluntary disclosures, log them, and document that they were used only to justify a higher offer, never a lower one.

Do this in the first 30 days. Every day the old field lives in your ATS is another candidate you might screen with a question that carries no cure.

The remote-role trap

The statute does not explicitly address fully remote roles. Counsel across Ogletree, Epstein Becker, and Jackson Lewis is landing in roughly the same place: if any Virginia-based candidate could plausibly fill the role, comply.

This is the same pattern that emerged around Colorado's Equal Pay for Equal Work Act, and it means the practical footprint of Virginia's law is much larger than "Virginia jobs." A remote Staff SRE role posted from a San Francisco headquartered startup, open to US-based candidates, is subject to Virginia's rules the moment a Virginian applies. Which is any role posted publicly.

The safe posture: post a good-faith range on every US remote req, full stop. The cost of over-compliance is trivial. The cost of a private suit with no statutory-damages cap on actual damages is not.

Where this goes over the next 12 months

Three predictions, based on how the New York and Washington enforcement waves developed.

Monitoring services will show up fast. Someone will ship a bot that scrapes Greenhouse, Lever, and Ashby public boards for Virginia-eligible roles missing ranges, mails cure notices at scale, and sells the resulting settlement data. The private right of action makes this economically viable in a way that AG-only enforcement never did.

Range breadth becomes the second wave of litigation. The first year of suits will be about missing ranges. The second year will be about $80K to $400K ranges that plaintiffs argue are not good-faith. Watch for Attorney General guidance defining acceptable breadth, mirroring what New Jersey's Division on Civil Rights attempted.

Sourcers with internal-req intel win the Q1 2027 recruiting cycle. The compounding effect of a full quarter of internal postings under the new rules means that by January, competing recruiters have a rolling 90-day comp file on every Virginia employer. The teams that ingest and act on that data will out-close the teams that do not.

This is where the pattern of building tooling around signals rather than around job boards pays off. Sourcing on a plain-English brief, layered over promotion signals and open-web mentions, is how you turn a compliance-driven data leak into a pipeline. Refolk was designed for exactly this: you describe the person, and the system finds them across the surfaces where the signal actually lives.

2

The one-week action list

If you run TA or sourcing and have not touched this yet, here is the seven-day version.

• Day 1. Audit every open Virginia and US-remote req for a compliant good-faith range. Cure now, before someone sends notice.
• Day 2. Kill every salary-history field in your ATS. Send written notice to staffing partners.
• Day 3. Rewrite the first-touch script. Retrain sourcers and coordinators. Record the training.
• Day 4. Set up internal monitoring: someone owns watching for cure notices in the shared inbox, with a 15-business-day SLA.
• Day 5. Build the sourcing side. Identify your top 10 Virginia-based target companies and start collecting their internal req ranges as employees share them.
• Day 6. Update your outbound templates to cite competitor ranges where you have them. This is the pitch advantage Virginia just handed you.
• Day 7. Review with counsel and document the whole thing. The record matters if you ever get noticed.

The compliance work is table stakes. The sourcing work is where the leverage is. Whichever side you sit on, July 1 already happened. The 15 days start whenever the first notice lands in your inbox.

FAQ

Does Virginia's law apply to my company if we have no office there?

Yes, if you have one or more Virginia-based employees. The law has no headcount threshold and no in-state office requirement. For fully remote roles, most employment counsel is advising clients to comply if any Virginia candidate could plausibly fill the role, which in practice means every publicly posted US-remote req.

What happens if a candidate volunteers their current salary?

You may use volunteered salary history only to support a higher offer, and only if doing so does not create an unlawful pay differential. You may never use it to justify a lower offer. Document that the disclosure was voluntary, log how it was used, and train recruiters not to prompt for the disclosure in any way, because prompted disclosure is not voluntary.

Is the 15-day cure window a full defense against a lawsuit?

Only for posting and good-faith range violations. If you cure within 15 business days of receiving written notice, and correct the posting on all original locations, a private plaintiff cannot sue on that violation. The cure does not apply to salary history questions, retaliation claims, or refusal-to-interview claims. Those have no cure and a one-year statute of limitations for private action.

How is this different from Maine's July 2026 law?

Maine's law took effect July 29, 2026, applies only to employers with 10 or more employees, and does not include a private right of action. Virginia applies to every employer regardless of size and allows private suits with a 15-business-day cure. Practically, Virginia carries far higher litigation risk and is the more urgent compliance lift for any company operating in both states.